Services¶

Core services¶

Service	Purpose
AdGuard Home	DNS filtering and rewrites; two synchronized instances
Caddy	HTTPS reverse proxy; wildcard certificates via DNS-01
Tailscale	Private remote access over a WireGuard mesh; no exposed inbound ports
Prometheus	Pulls host and service telemetry
Grafana	Dashboards for infrastructure health
Proxmox Backup Server	Backup testing; currently evaluated in a test LXC

Hosted applications¶

Representative workloads on Unraid include a dashboard, Immich photo management, Jellyfin media serving, and additional media automation services. The operational focus is container lifecycle, persistent storage, private access, reverse proxying, monitoring and recovery.

Services use consistent FQDNs such as service.example.net. Internal DNS resolves them to Caddy, and remote mesh clients use the same names through split DNS.

Reverse proxy standard (Caddy)¶

Caddyfile excerpt:

# /etc/caddy/Caddyfile
{
    acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
    email {env.ACME_EMAIL}
}
adguard.example.net {
    reverse_proxy 192.168.X.X:80
}
grafana.example.net {
    reverse_proxy 192.168.X.X:3000
}
immich.example.net {
    request_body {
        max_size 5GB
    }
    reverse_proxy 192.168.X.X:2283 {
        flush_interval -1
    }
}

Change procedure¶

caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy
systemctl status caddy --no-pager

Make the smallest required edit.
Validate before reload.
Reload without dropping connections.
Confirm status and test the affected FQDN.
Review recent logs if the health check fails.

Self-signed upstream exception

An upstream with a self-signed certificate may need explicit transport configuration. Keep that exception narrow and documented rather than a global default.

AdGuard Home¶

Two AdGuard Home instances run with synchronized configuration, which reduces the impact of a single-instance failure. A DNS rewrite maps *.example.net to Caddy, giving each service a consistent name on the LAN and, through split DNS, on the Tailscale mesh. A baseline configuration is stored on Unraid so the DNS service can be rebuilt quickly.

Tailscale¶

Tailscale provides private remote access over a WireGuard mesh with no exposed inbound ports. Mesh membership is required for remote access, and domain queries traverse the mesh via split DNS.

Monitoring (Prometheus and Grafana)¶

Node exporters (Unraid and Proxmox) and service endpoints (HTTP and DNS checks) feed Prometheus at a 15-second scrape interval, and Grafana renders the dashboards.

global:
  scrape_interval: 15s
scrape_configs:
  - job_name: prometheus
    static_configs:
      - targets: ['localhost:9090']
  - job_name: infrastructure
    static_configs:
      - targets:
          - '192.168.X.X:9100'   # Unraid exporter
          - '192.168.X.X:9100'   # Proxmox node 1
          - '192.168.X.X:9100'   # Proxmox node 2

Observe: host availability, CPU and memory pressure, storage and filesystem trends, and exporter scrape failures.

Investigate: correlate service errors with host resource changes, separate process failure from application-layer failure, and confirm recovery after a restart or maintenance.

Monitoring is not recovery

Prometheus and Grafana provide visibility. Separate health-check scripts perform bounded remediation and notification; see Automation.